I had a look at this and it's surprisingly tricky (to me at least). The problem is that you can't mix stats calculated by some field with stats calculated over the entire set - once you've specified a split-by clause in your stats command, ALL stats will be calculated by that way. The only solution I've come up with is running one stats command for generating a column containing the unique IP count for each timespan, and then use appendcols for adding the individual columns for each IP. This is pretty slow and resource intensive because appendcols needs to run its own subsearch, so you have to run the same base query twice. I'd be happy if someone could find a better solution, but for what it's worth, here is mine: index=XXX | timechart span=1d dc(src_ip) | appendcols [search index=XXX | timechart span=1d count by src_ip | fields - _time] ... View more

You should pretty much never need to run extract reload=true , nor restart Splunk for any changes to search-time settings like field extractions. What extract reload=true does is it runs the whole field extraction process a second time, so if you have fields that are not created the first round but work after the second, that is an indicator of that conditions that weren't met in order to extract the fields the first time are now met during the second. I'd put my money on that the field extraction(s) you're seeing problems with are ones that use another field as their source, and when you try to extract them the first time this field does not yet exist. In order to make this work you need to make sure that your field extractions run in the correct order. ... View more

The problem is that once you've done top actChar , the top command will only emit a few fields - namely, actChar , count and percent . So, the actType field you're trying to use in your lookup isn't available which means that your lookup will fail. If actType and actChar always correspond to each other you could just do my_data | top actChar,actType | ... ... View more

Have a look at format. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Format You can do this by using a subsearch and calling format with custom parameters in order to alter the way the subsearch outputs its results. [search ... | rename fieldA as field | fields field | format "(" "(" "OR" ")" "OR" ")"] | ... ... View more

The stats command values() does this. ... | stats dc(UserID) AS UserCount, values(UserID) as UniqueUsers by FileID | ... http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions ... View more

These are Splunk's indexes. The directory names in var/lib/splunk usually correspond to the index names, so if you want to see what all that data is, just search the corresponding index name in Splunk on your search head. ... View more